SQL Prevention Problem

[VegasKiller]

Hello I am trying to protect my login sequence from sql injections but am getting an error. I have changed this:

if ($_POST['username'] == "" || $_POST['password'] == "")
{

 

To This:

if mysql_real_escape_string($_POST['username'] == "")) || mysql_real_escape_string($_POST['password'] == ""))
{

 

and m getting this error:

Parse error: syntax error, unexpected T_STRING, expecting '(' in /verify.php on line 3 Can someone please help me with this, Line 3 is the long line.

[Jordan Palmer]

$_POST['username'] = mysql_real_escape_string($_POST['username']);

 

Then do the IF..

[VegasKiller]

1

[corruptcity || skalman]

you have 2 close brackets and none open brackets for the $_POST['username'] aswell

[rulerofzu]

mc2?

$db->escape

Personally I like to name it

so $var=$db->escape($_POST....

if your on a webhost with PHP5 then you can use filter_input and filter_var.

[Dominion]

You don't use mres twice...

I suggest a quick google of how to secure against sql injections.

[Paul Evans]

$_POST['username'] = mysql_real_escape_string($_POST['username']);
$_POST['password'] = mysql_real_escape_string($_POST['password']);
if mysql_real_escape_string($_POST['username'] == "") || mysql_real_escape_string($_POST['password'] == "")
{

wow

maybe:

$_POST['username'] = mysql_real_escape_string($_POST['username']);
$_POST['password'] = mysql_real_escape_string($_POST['password']);
if ( $_POST['username'] == "" || $_POST['password'] == "" )
{

[Djkanna]

You wouldn't have this problem if you actually paid the fella you owe $500+ too, he wouldn't be exploiting your game.

[Paul Evans]

who does he owe 500+ too?

[SilvaTungDevil]

In on thread to find out :D

[Blade Maker]

He owes me $520 and scammed me, now will not even reply, so now he wants his login secure lol.

I already messaged him how but guess he is just a noob, really though we would have made a great game if he never scammed me.

Vegas I still want that money, please give it to me, I atleast want $100 at the least.

[Dominion]

http://makewebgames.io/board873-collaboration-experiences/

With appropriate documentation.

There is really no way you can keep posting that without some way of proving it.

[Yakura]

$_POST['username'] = mysql_real_escape_string($_POST['username']);
$_POST['password'] = mysql_real_escape_string($_POST['password']);
if ($_POST['username'] == "" || $_POST['password'] == "" ){

 

Then you tell them to fill out both forms then you check if it matches what is in the database. You should really know this.

[Djkanna]

if (trim ($_POST['var']) == '' ) {
//continue to process.
}

[Paul Evans]

I really don't get how he could owe someone 520 bucks... what did you do for it lol

[Jordan Palmer]

Stay on initial subject please

[Blade Maker]

Ok sorry.

[Paul Evans]

Jordan: The Big RipOFFF eat me :)

(I know i put 3 f's so blah!)